China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware Ravie LakshmananApr 07, 2026Vulnerability / Threat Intelligence A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate "high-velocity" attacks and break into susceptible internet-facing systems. "The threat actor's high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States," the Microsoft Threat Intelligence team said. Attacks mounted by Storm-1175 have also leveraged zero-day exploits, in some cases, before they have been publicly disclosed, as well as recently disclosed vulnerabilities to obtain initial access. Select incidents have involved the threat actor chaining together multiple exploits (e.g., OWASSRF) for post-compromise activity. Upon gaining a foothold, the financially motivated cybercriminal actor swiftly moves to exfiltrate data and deploy Medusa ransomware within a span of a few days, or, in select incidents, within 24 hours. To aid in these efforts, the group creates persistence by creating new user accounts, deploying web shells or legitimate remote monitoring and management (RMM) software for lateral movement, conducting credential theft, and interfering with the normal functioning of security solutions, before dropping the ransomware. Since 2023, Storm-1175 has been linked to the exploitation of more than 16 vulnerabilities - CVE-2023-21529 (Microsoft Exchange Server) CVE-2023-27351 and CVE-2023-27350 (Papercut) CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure) CVE-2024-1708 and CVE-2024-1709 (ConnectWise ScreenConnect) CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity) CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp) CVE‑2025‑31161 (CrushFTP) CVE-2025-10035 (Fortra GoAnywhere MFT) CVE-2025-52691 and CVE-2026-23760 (SmarterTools SmarterMail) CVE-2026-1731 (BeyondTrust) Both CVE-2025-10035 and CVE-2026-23760 are said to have been exploited as zero-days prior to them being publicly disclosed.As of late 2024, the hacking crew has exhibited a flair for targeting Linux systems, including exploiting vulnerable Oracle WebLogic instances across several organizations. However, the exact vulnerability that was being weaponized in these attacks remains unknown. "Storm-1175 rotates exploits quickly during the time between disclosure and patch availability or adoption, taking advantage of the period where many organizations remain unprotected," Microsoft said. Some of the notable tactics observed in these attacks are as follows - Using living-off-the-land binaries (LOLBins), including PowerShell and PsExec, along with Impacket for lateral movement. Relying on PDQ Deployer for both lateral movement and payload delivery, including Medusa ransomware, across the network. Modifying Windows Firewall policies to enable Remote Desktop Protocol (RDP) and deliver malicious payloads to other devices. Carrying out credential dumping using Impacket and Mimikatz. Configuring Microsoft Defender Antivirus exclusions to prevent it from blocking ransomware payloads. Leveraging Bandizip and Rclone for data collection and exfiltration, respectively. The bigger implication here is that RMM tools like AnyDesk, Atera, MeshAgent, ConnectWise ScreenConnect, or SimpleHelp are becoming dual-use infrastructure for covert operations, as they allow threat actors to blend malicious traffic into trusted, encrypted platforms and reduce the likelihood of detection. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cybersecurity, data breach, Microsoft, ransomware, Threat Intelligence, Vulnerability, zero-day Trending News ⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers and More Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in Recent Mass Attacks Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks Google Adds 24-Hour Wait for Unverified App Sideloading to Reduce Malware and Scams China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks 54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security ThreatsDay Bulletin: PQC Push, AI Vuln Hunting, Pirated Traps, Phishing Kits and 20 More Stories Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets TeamPCP Backdoors LiteLLM Versions 1.82.7–1.82.8 via Trivy CI/CD Compromise Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files FCC Bans New Foreign-Made Routers Over Supply Chain and Cyber Risk Concerns FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data Load More ▼ Popular Resources SANS SEC401: Get Hands On Skills to Detect and Respond to Cyber Threats [Demo] Discover SaaS Risks and Monitor Every App in Your Environment [Guide] Learn How to Govern AI Agents With Proven Market Guidance Detect AI-Driven Threats Faster With Full Network Visibility